How to Inspect a JWT Safely

Published August 29, 2026

Prepared by Innealan Editorial

A JSON Web Token has three dot-separated sections: a header, a payload, and a signature. The first two are encoded, not encrypted, so anyone holding a token can read them.

Read the parts without trusting them

Decoding reveals claims such as sub, aud, iat, and exp. It does not establish who signed the token or whether it has been altered. A payload that says "role":"admin" is only a claim until a server verifies the signature with a trusted issuer key and permits the algorithm used.

For a quick inspection, check the iss value, intended aud, and whether exp is already in the past. Those checks help diagnose a token, but they are not a substitute for server-side verification.

Keep real tokens out of tickets

Tokens may grant account access. Do not paste a production token into a ticket, chat, or public decoder. Revoke a token if it was shared accidentally, even when you think it has expired.

For local inspection, use the JWT Decoder, which runs in your browser and displays expiry information without verifying the signature.